// For flags

CVE-2016-0456

 

Severity Score

5.0
*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Unspecified vulnerability in the Application Mgmt Pack for E-Business Suite component in Oracle E-Business Suite 12.1 and 12.2 allows remote attackers to affect confidentiality via vectors related to REST Framework, a different vulnerability than CVE-2016-0457. NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this issue is an XML External Entity (XXE) vulnerability, which allows remote attackers to read arbitrary files, cause a denial of service, conduct server-side request forgery (SSRF) attacks, or conduct SMB Relay attacks via a crafted DTD in an XML request to OA_HTML/copxmllcmservicecontroller.js.

Vulnerabilidad no especificada en el Application Mgmt Pack para el componente E-Business Suite en Oracle E-Business Suite 12.1 y 12.2 permite a atacantes remotos afectar a la confidencialidad a través de vectores relacionados con REST Framework, una vulnerabilidad diferente a CVE-2016-0457. NOTA: la información anterior es de la CPU de Enero de 2016. Oracle no ha comentado sobre alegaciones de terceros que consideran que este problema es una vulnerabilidad de Entidad Externa XML (XXE) , lo que permite a atacantes remotos leer archivos arbitrarios, causar una denegación de servicio, llevar a cabo ataques de SSRF o llevar a cabo ataques SMB Relay a través de un DTD manipulado en una petición XML a OA_HTML/copxmllcmservicecontroller.js.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Partial
Integrity
None
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2015-12-09 CVE Reserved
  • 2016-01-21 CVE Published
  • 2023-03-07 EPSS Updated
  • 2024-08-05 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Oracle
Search vendor "Oracle"
E-business Suite
Search vendor "Oracle" for product "E-business Suite"
12.1
Search vendor "Oracle" for product "E-business Suite" and version "12.1"
-
Affected
Oracle
Search vendor "Oracle"
E-business Suite
Search vendor "Oracle" for product "E-business Suite"
12.2
Search vendor "Oracle" for product "E-business Suite" and version "12.2"
-
Affected